CVE-2024-5985: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2024-5851

A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=featureschedule&op=list of the component SMS Schedule Handler. The manipulation of the argument name/message leads to basic cross site scripting. It...

CVE-2024-5851: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=featureschedule&op=list of the component SMS Schedule Handler. The manipulation of the argument name/message leads to basic cross site scripting. It...

CVE-2024-5774: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Stock Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attack c...

CVE-2024-36773

A cross-site scripting XSS vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php...

CVE-2024-36773: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php...

CVE-2024-5673

Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fmcurrentdir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session...

CVE-2024-5673: Improper Neutralization of Input During Web Page Generation

Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fmcurrentdir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session...

PT-2024-37043

Name of the Vulnerable Software and Affected Versions Dulldusk's PHP File Manager version 1.7.8 Description The issue consists of a Cross-Site Scripting XSS vulnerability through the fm current dir parameter of the "index.php" endpoint. An attacker could send a specially crafted JavaScript payloa...

CVE-2024-5636 itsourcecode Bakery Online Ordering System index.php sql injection

A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file report/index.php. The manipulation of the argument procduct leads to sql injection. The attack may be launched remotely. The...

CVE-2024-5636 itsourcecode Bakery Online Ordering System index.php sql injection

A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file report/index.php. The manipulation of the argument procduct leads to sql injection. The attack may be launched remotely. The...

PT-2024-36802

Name of the Vulnerable Software and Affected Versions itsourcecode Bakery Online Ordering System version 1.0 Description A critical issue affects some unknown functionality of the file report/index.php. The manipulation of the procduct argument leads to SQL injection. The attack can be launched...

CVE-2024-5636: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file report/index.php. The manipulation of the argument procduct leads to sql injection. The attack may be launched remotely. The...

CVE-2024-5635 itsourcecode Bakery Online Ordering System index.php sql injection

A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument txtsearch leads to sql injection. The attack can be launched remotely...

CVE-2024-5635: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument txtsearch leads to sql injection. The attack can be launched remotely...

PT-2024-36798

Name of the Vulnerable Software and Affected Versions itsourcecode Bakery Online Ordering System version 1.0 Description A critical issue has been found in the itsourcecode Bakery Online Ordering System, affecting an unknown functionality of the file index.php. The manipulation of the txtsearch...

CVE-2024-34987: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in the ofrs/admin/index.php script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input field during the login process...

CVE-2024-33999 moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php

The referrer URL used by MFA required additional sanitizing, rather than being used directly...

CVE-2024-35468: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL commands via the password parameter...

Cross-Site Scripting

phpservermon/phpservermon is vulnerable to Cross-Site Scripting. The vulnerability is due to the lack of proper validation of input parameters in index.php, which allows an attacker to create a specially crafted URL and send it to a victim, to retrieve their session details...